CVE-2026-71513
Last modified
CVE-2026-71513 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nltk | Nltk | < 3.10.3 |
References
- https://github.com/nltk/nltkProduct
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-71513?
How severe is CVE-2026-71513?
How do I fix CVE-2026-71513?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-71507Dolibarr before 24.0.0 contains a broken object-level author…6.5
- CVE-2026-71508Dolibarr before 24.0.0 contains an improper authorization vu…6.5
- CVE-2026-71509Dolibarr before 24.0.0 contains an improper authorization vu…6.5
- CVE-2026-7151A vulnerability was determined in Tenda HG3 2.0. Impacted is…8.8
- CVE-2026-71510Dolibarr before 24.0.0 contains a SQL injection vulnerabilit…6.5
- CVE-2026-71511Dolibarr before 24.0.0 contains a sensitive data exposure vu…6.5
- CVE-2026-71514NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerab…3.3
- CVE-2026-71518Typemill before 2.26.0 contains an authorization bypass vuln…7.5
- CVE-2026-7152A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
- CVE-2026-7153A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
- CVE-2026-71537Paymenter is a free and open-source webshop solution for man…6.5
- CVE-2026-71538@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of …8.5
Are you affected by CVE-2026-71513?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST